npm: 16 Malicious Packages Disclosed in Instantaneous Drop
On July 6, 2026, 16 malicious packages were simultaneously disclosed on the npm registry, indicating a coordinated, rapid takedown action.
Key findings
- 16 malicious npm packages were simultaneously disclosed on July 6, 2026.
- Many packages were published just hours before their disclosure, indicating fresh threats.
- Several distinct naming patterns, such as
@flex-ng/,@logdna-web/,enbd-react-, andtme-, suggest a multi-faceted campaign. - Extracted IOCs point to potential credential harvesting, system reconnaissance, and data exfiltration.
- Affected systems should be considered compromised, requiring immediate credential rotation.
On July 6, 2026, the npm registry saw the simultaneous disclosure of 16 malicious packages, all flagged at 00:00 UTC. This instantaneous takedown suggests a rapid and coordinated response to a cluster of threats. The majority of these packages were newly published, with many appearing on the registry just hours before their removal, indicating a campaign focused on fresh typosquats or impersonations.
While no single overarching naming pattern was identified across all 16 packages, several distinct clusters emerged, suggesting multiple, possibly related, attack vectors or actor groups. For instance, three packages shared the @flex-ng/ scope (@flex-ng/error-component, @flex-ng/filter-pipe, @flex-ng/header-component), while another two used @logdna-web/ (@logdna-web/shared, @logdna-web/styles). A third group adopted the enbd-react- prefix (enbd-react-error-boundry, enbd-react-lib, enbd-react-logger), and a fourth used tme- (tme-error, tme-xca, tme-xca-react). The packages pinokio-redis and zredis-typed also appear to be related, potentially targeting the popular Redis library. The rapid publication of most of these packages, often within hours of their disclosure, is a key characteristic, indicating a strategy of quick deployment and removal.
Although specific behavioral findings for each package were not detailed, the extracted Indicators of Compromise (IOCs) from the advisories provide strong clues about the malicious intent. These IOCs include file names such as agentstartupaudit.js, chromiumextensiondbharvest.js, cli-agent.js, contentscanner.js, deploymentcipherdata.js, deploymentdefaults.js, discordrelayupload.js, encode-deployment.mjs, and ensure-dist.mjs. These names collectively suggest a focus on system reconnaissance, credential harvesting (especially from browser extensions and Discord), and data exfiltration. The presence of box.com and cloudflare.com in the IOCs could indicate potential command-and-control infrastructure or data staging points for exfiltrated information.
The nature of these threats implies a severe risk to any system that installed the malicious versions. Such packages often aim to establish persistence, steal sensitive data like API keys, environment variables, or user credentials, and potentially enable further compromise of the development environment or downstream systems. Users who may have installed these packages should consider their systems fully compromised. Immediate action is required to mitigate potential damage, including rotating all credentials and secrets from a separate, clean machine.
Developers should audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, the affected packages must be immediately removed, and a thorough security review of the compromised environment should be conducted. Specific package names to look for include:
@flex-ng/error-component@idms-corp/auth-uipinokio-redis@logdna-web/sharedbox-react-uixenbd-react-libsams-sr-sdk-h5tme-xcazredis-typed
If any of these packages were installed, it is critical to rotate all potentially exposed credentials, including npm tokens, API keys, and any other sensitive information accessible from the build or deployment environment.
This rapid, coordinated disclosure highlights the ongoing challenge of securing open-source software supply chains. The strategy of deploying multiple, distinct yet related, malicious packages in a short timeframe, often with very recent publication dates, suggests an attempt to evade detection or overwhelm automated security systems. While the specific actor or motivation remains undisclosed, such bursts underscore the need for continuous vigilance and robust automated scanning capabilities within package registries to identify and neutralize threats swiftly.